使用链接进行电子邮件验证是一个坏主意
在我的注册过程中，用户注册后，他们会收到通过电子邮件发送的验证链接，如果他们单击该链接，那么他们的帐户才会得到验证。但这种验证方法对于机器人来说是不是太容易了？
我认为电子邮件可以由机器人创建，但可以肯定的是，如果验证只是单击链接，那么它也可以由机器人自动完成。我不确定，因为我没有这样做，也不想测试它只是为了知道，但我的问题是这种验证方法是否有缺陷？
我正在考虑将验证码作为文本发送给用户，他们必须手动将其复制/粘贴到表单中，并且该表单受验证码保护。这是一个更好的主意吗？它有什么缺陷吗？
In my registration process, the user registers, they get emailed a verification link, and if they click it, only then would their account be verified. But isn't this verification method too easy for the bots?
I think an email could be created by a bot, but for sure if the verification is just clicking a link, it could also be automated by a bot. I'm not sure since I haven't done this and don't care to test it just to know, but my question is isn't this verification method flawed?
I'm thinking about sending the verification code to the user as a text which they would have to copy/paste manually into a form AND the form is captcha protected. Is this a better idea? any flaws with it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
大多数建议都是关于验证电子邮件和使用验证码，您当然应该这样做，但请记住，这些方法都不是完全安全的。
电子邮件验证
机器人可以轻松“点击”任何电子邮件中的链接。对于机器人作者来说，复制和粘贴某些内容会稍微麻烦一些，但也不会太烦人。一般来说，电子邮件验证就是这样——电子邮件验证。
您验证电子邮件是否可能由尝试注册的人控制，但当然，由于电子邮件通常通过不受信任的 TCP 以明文形式发送，并且依赖于不安全的 DNS，因此在我们全部使用 DNSSEC 并加密所有流量之前，它将轻松嗅探电子邮件并欺骗服务器和客户端。需要意识到的重要一点是，使用电子邮件验证，您只能在一定程度上确信与您交谈的任何人或任何东西确实是该电子邮件地址的用户。
图灵测试
回答一个只有人类应该知道答案的问题会更烦人，但考虑到您可能不会有无限数量的问题，机器人作者可能会将未知问题重定向到真人，并使用缓存的答案（如果有）问题重复不止一次。像我最近在一些网站上看到的图灵测试一样，回答诸如“12+8 是什么”之类的问题完全会适得其反，因为这个问题实际上对机器人来说比对人类来说更容易。最流行的图灵测试可能是验证码，但在这里您也必须意识到它们可能会被愚弄。
首先，人们展示了规避验证码的方法，例如，请参阅 DEFCON 18 中的解码 reCAPTCHA 演讲。许多验证码对于机器人来说更容易破译，因为它们是由易于逆向的算法生成的。 reCAPTCHA 扭曲也非常简单，但它们使用的单词是真实的扫描单词，这对于 OCR 来说很难，所以原则上它对于机器人来说应该更困难，但情况并非总是如此。
并且还可以在其他网站上显示您想要猜测的验证码，并让人们为您回答。此外，还有一个黑市，里面有真正解决验证码的人，因此，如果您的机器人作者不介意花两美分购买一打验证码，那么无论这对人类来说有多困难，真正的人类都会解决它反正。
底线底线
是，使用任何机器人阻止技术总是会影响机器人所有者（垃圾邮件发送者或任何想要在您的系统中注册大量用户的其他人）愿意花费多少时间、精力和金钱，以及您将容忍给您的用户带来多少不便，因为最终您将永远无法进行任何自动化测试来区分人类和机器人，而不会真正惹恼人类并疏远残疾人（已有人曾经尝试过猜测 reCAPTCHA 的音频版本吗？），但你的机器人实际上可能是人力驱动的，所以可以这么说，不是真正的机器人，而是半机械人。
这是一场军备竞赛，诚实的用户要为此付出代价。请记住所有这些。
Most of the suggestions are about verifying emails and using CAPTCHAs which of course you should do, but keep in mind that none of these methods is completely bulletproof.
Email verification
A bot can easily "click" on links in any email. Copying and pasting something would be slightly more annoying for the bot author but not much. Generally email verification is just that - email verification.
You verify if the email is likely to be controlled by whoever tries to register, but of course since email is usually sent in cleartext over untrusted TCP and relies on insecure DNS, then until we're all using DNSSEC and encrypt all traffic it will be easy to sniff emails and spoof servers and clients. The important thing to realize is that using email verification you get only a certain degree of confidence that whoever or whatever you are talking to is really a user of that email address.
Turing test
Answering a question that only human should know the answer to would be still more annoying but considering that you probably wouldn't have an infinite number of questions, the bot author might redirect unknown question to a real human and use cached answers if any question repeats more than once. Answering a question like "what is 12+8" like I've seen in some websites lately as a Turing test is completely counterproductive since this question is actually easier for bots than for humans. Probably the most popular Turing test for that are CAPTCHAs but here you also have to realize that they can be fooled.
First of all people are showing methods of circumventing CAPTCHAs, for example see the Decoding reCAPTCHA talk from DEFCON 18. Many CAPTCHAs are much easier for robots to decipher since they are generated by algorithms that are trivial to reverse. The reCAPTCHA distortions are also pretty simple but the words that they use are real scanned words that was hard for OCRs so in principle it should be much harder for bots, but it is not always the case.
And there is also a possibility to display captchas that you want to guess on other websites and have people answer it for you. Also there is a black market of people actually solving captchas so if your bot author doesn't mind paying something like two cents for a dozen then no matter how hard it is for humans, actual humans will solve it anyway.
Bottom line
The bottom line is that using any of the bot-stopping techniques will always be a compromise of how much would a bot owner (a spammer or anyone else who wants to register a lot of users in your system) be willing to spend time, effort and money to do it, and how much inconvenience for your users are you going to tolerate, because ultimately you will never be able to do any automated test to tell humans and bots apart without actually annoying humans and alienating people with disabilities (has anyone ever tried to guess the audio version of reCAPTCHA?), and still your bots may actually be human-powered, so not really bots but cyborgs, so to speak.
It's an arms race for which your honest users are paying a price. Please keep all of that in mind.
问题是你想验证什么？当您发送电子邮件地址的链接时，您可以知道注册该帐户的任何人都可以访问该电子邮件地址。除此之外，它不会告诉您有关他们的任何信息。
所以，是的，机器人可以创建一个帐户，并用它来注册。如果您想阻止机器人，那么您需要添加验证码。请注意，添加代码进行复制/粘贴没有什么意义——这对于机器人来说很容易做到，而且也不会通过验证码获得任何好处。
The questions is what are you trying to verify? When you send a link to an email address, what you can know is that whoever registered that account has access to the email address. It doesn't tell you anything about them other than that.
So yeah, bots can create an account, and use it for registration. If you want to stop bots, then yeah, a captcha is what you need to add. Note that there's little point in adding the code to copy/paste - that's both easy for a bot to do, and also doesn't gain you anything over the captcha.
一如既往，安全性和便利性通常是相互竞争的。
电子邮件中的链接仅验证其是否为有效电子邮件地址。是的，机器人很容易处理这个问题。但您的服务是否如此有价值以至于机器人会攻击它？
验证码始终是确保您的用户是人类的最佳方法。额外的编码和与之相关的挫折是一种权衡。
最后，让事情尽可能简单，但不要太简单。
As always, security and convenience are generally competing with each other.
A link in an email simply validates that it is an active email address. Yes, it's easy for the bots to handle this. But is your service so valuable that bots will be attacking it?
A CAPTCHA is always the way to go to ensure your users are human. The additional coding and frustrations involved with it are a trade-off.
In the end, keep things as simple as possible, but not simpler.
正如已经指出的，您只需进行一些验证码验证即可。
我的建议是在您的应用程序创建用户帐户并发送验证电子邮件之前进行人工验证。您的网站的附加值不能轻易被迫仅发送垃圾邮件验证电子邮件并创建虚假的等待验证帐户。
如果您这样做，链接就没有问题。
As pointed out already, you simply have some CAPTCHA validation.
My suggestion is though do human validation before your app creates the user account and sends the verification email. Added value of your site can't easily be forced to just spam verification emails and create bogus waiting to be verified accounts.
Nothing wrong with a link if you do that.
是的，机器人可以输入电子邮件并检查回复。我还听说过一些努力让机器人在图像识别和回答验证码方面做得更好，尽管我不能肯定地说它们有多好。如果您真的很担心，我会选择：
最后一个可能被证明是消除问题的最佳方法机器人，但它也会限制谁注册您的网站。此外，您拥有的验证越多，您就越会惹恼用户，并且会增加他们注册的障碍，这也可能是一个相当大的缺点。就我个人而言，我认为验证码是机器人保护与用户不便之间的良好平衡。
Yes, bots can enter emails and check the responses. I've also heard of endeavors toward bots getting better at image recognition and answering captchas, although I can't say for sure how good they are. If you are really really concerned, I would go with:
The last one might prove to be the best in eliminating bots, but it will also limit who signs up for your website. Also, the more validations you have, the more you'll annoy users and the more you'll increase the barriers to getting them to sign up, which could also be a pretty big drawback. Personally, I think captchas are a good balance of bot protection vs. user inconvenience.
您是仅验证电子邮件还是进行完整注册？
我总是先验证电子邮件帐户。然后一旦验证完成注册过程。
因此，在验证电子邮件步骤中添加验证码。
换句话说，要求用户输入他们的电子邮件地址，输入验证码并提交表单。
这样，只有真实的人才能收到发送的验证电子邮件。
当然，它并不能阻止人类机器人。
DC
这也意味着您不需要存储失败/错误的注册数据。
一个问题是用户使用一个电子邮件地址进行验证，然后在注册过程中更改它，我以这种方式处理。
当用户提交其电子邮件地址时，根本不会存储数据。相反，我使用
$validation_code = md5(trim($email)+$secret)生成验证码。这样他们就无法更改实际注册表上的电子邮件地址。电子邮件和验证码作为隐藏字段保留到末尾，以验证电子邮件地址。如果验证的电子邮件地址发生更改，则注册将失败，因为 md5 不再匹配。直流
Are you verifying an email only or doing a full registration?
I always verify the email account first. then once verified complete the registration process.
so add a captcha at the verify email step.
In other words, ask the user to enter their email address, enter the captcha and submit the form.
That way only real people get the verification email sent.
It doesn't prevent human bots of course.
DC
It also means you don't need to store failed/bad registration data.
One problem is a user validating with one email address and then changing it during the registration process, I handle that this way..
When a user submits their email address the data is not stored at all. Instead I use
$validation_code = md5(trim($email)+$secret)to generate the verification code. That way they can't change the email address on the actual registration form. The email and verification code is carried as a hidden field to the end to validate the email address. if the email address is altered from the verified one, registration will fail as the md5 no longer matches.DC
我在验证电子邮件和测试方面遇到了类似的问题。如果您想进行端到端测试电子邮件验证，请尝试 EmailE2E.com — 它是免费的。
您可以通过 API 从随机生成的收件箱发送和接收电子邮件。
它非常适合测试 Firebase、Amazon Cognito 或在注册期间使用电子邮件验证码的其他 OAuth 提供商。另外它还有 Java 和 JS 客户端。
I ran into similar problems with verification emails and testing. If you want to end-to-end test email verification try EmailE2E.com — it's free.
You can send and receive emails from randomly generated inboxes via an API.
It's perfect for testing Firebase, Amazon Cognito, or other OAuth providers that use email verification codes during sign up. Plus it has clients in Java and JS.